Communication method and apparatus

Abstract

The application provides a communication method and device, the method is applied to a first CPE, the first CPE is in SDWAN networking, the SDWAN networking further includes a second CPE, and a data channel has been established between the first CPE and the second CPE, and the method comprises the following steps: after storing a first IPsec SA and a second IPsec SA locally, sending a first keep-alive message to the second CPE through the data channel; judging whether a first keep-alive response sent by the second CPE through the data channel is received; if the first keep-alive response is received, performing increment processing on an anti-replay sequence number included in a data message to be sent to the second CPE; wherein the first IPsec SA is configured by a user through a command line.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method and apparatus. Background Technology

[0002] Software-defined wide area network (SDWAN) is a VPN technology that applies SDN technology to wide area networks.

[0003] Its control plane uses standard MP-BGP to advertise and transmit Transport Tunnel Endpoint (TTE) information and EVPN routing information, thereby enabling the learning and publication of MAC addresses and IP addresses between different sites; its data plane uses UDP to encapsulate and forward data packets, ensuring fast and secure data transmission, providing secure and reliable interconnection services for enterprise networks, data centers, etc., scattered across a wide geographical area.

[0004] IP Security (IPsec) is a three-layer tunneling encryption protocol developed by the IETF. It provides high-quality, cryptographically based security for data transmitted over the Internet and is a traditional security technology for implementing three-layer Virtual Private Networks (VPNs).

[0005] A Security Association (SA) is the foundation and essence of IPsec. IPsec provides secure communication between two endpoints, known as IPsec peers. An SA is an agreement between IPsec peers on certain elements. These include the security protocol used (AH, ESP, or a combination of both), the encapsulation mode of protocol messages (transport mode or tunnel mode), the authentication algorithm (HMAC-MD5, HMAC-SHA1, or SM3), the encryption algorithm (DES, 3DES, AES, or SM), the shared key protecting data in a specific flow, and the key's lifespan, among other things.

[0006] Security Tokens (SAs) are unidirectional. In bidirectional communication between two peers, at least two SAs are required to secure data packets in both directions. Currently, SAs are generated manually or through automatic negotiation via Internet Key Exchange (IKE).

[0007] Manual configuration refers to administrators configuring all SA information by entering command lines. This method is more complex and lacks support for certain advanced features (e.g., anti-replay functionality). Its advantage is that it can implement IPsec functionality independently of IKE, making it suitable for small, static network environments with a limited number of peers for secure communication. IKE auto-negotiation refers to peers automatically negotiating and generating an SA through the IKE protocol, which is then maintained by the IKE protocol. This method is simpler to configure, has strong scalability, and is suitable for medium to large-scale dynamic network environments.

[0008] like Figure 1 As shown, Figure 1 This is a diagram illustrating the existing SDWAN network topology. Figure 1 In this setup, Customer Premise Equipment (CPE) 1 and CPE 2 each generate their own IPsec SA and synchronize it to other CPEs via the control channel established with the RR. When data needs to be transmitted between CPEs, the CPE will use the peer's IPsec SA to encrypt and protect the data to be transmitted.

[0009] When CPE1 sends a data packet to CPE2, CPE1 encrypts the packet using CPE2's IPsec SA2 encryption before sending it to CPE2. Upon receiving the data packet, CPE2 decrypts it using IPsec SA2. Conversely, when CPE2 sends a data packet to CPE1, CPE2 encrypts the packet using CPE1's IPsec SA1 encryption before sending it to CPE1. Upon receiving the data packet, CPE1 decrypts it using IPsec SA1.

[0010] Since IPsec SAs are all unidirectional, network devices use different IPsec SAs when performing encryption and decryption processes. Typically, the local IPsec SA is used for decryption, while the remote IPsec SA is used for encryption.

[0011] However, the existing method of generating IPsec SAs (Service Agents) also exposes the following problems when applied to CPEs for data transmission: Currently, IPsec SAs are typically configured manually on each CPE. However, manually configured IPsec SAs cannot support replay protection. For example, after an administrator configures the IPsec SA for the local CPE, the IPsec SA for the remote CPE has not yet been synchronized locally. At this time, the local end fails to send data packets, but when generating data packets, it continuously increments the anti-replay sequence number included in the data packets. After the local and remote IPsec SAs for each CPE are configured, the remote end receives the data packets. The remote end recognizes that the anti-replay sequence number included in the data packet is too large, exceeding the local anti-replay window, and discards the data packet, resulting in packet loss. Summary of the Invention

[0012] In view of this, this application provides a communication method and apparatus to solve the problem that in the existing SA generation methods, manually configured IPsec SAs cannot support anti-replay function, resulting in packet loss.

[0013] In a first aspect, this application provides a communication method applied to a first CPE, the first CPE being located within an SDWAN network, the SDWAN network further including a second CPE, a data channel being established between the first CPE and the second CPE, the method comprising:

[0014] Once the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, the first keep-alive message is sent to the second CPE through the data channel.

[0015] Determine whether a first keep-alive response sent by the second CPE through the data channel has been received;

[0016] If the first keep-alive response is received, the anti-replay sequence number included in the data packet to be sent to the second CPE will be incremented.

[0017] The first IPsec SA is configured by the user via command line.

[0018] Secondly, this application provides a communication device applied to a first CPE, the first CPE being located within an SDWAN network, the SDWAN network further including a second CPE, a data channel being established between the first CPE and the second CPE, the device comprising: a sending unit, a first judging unit, a processing unit, and a receiving unit.

[0019] The sending unit is configured to send the first keep-alive message to the second CPE through the data channel after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally.

[0020] The first determining unit is used to determine whether the receiving unit has received the first keep-alive response sent by the second CPE through the data channel;

[0021] The processing unit is configured to increment the anti-replay sequence number included in the data packet to be sent to the second CPE if the receiving unit receives the first keep-alive response;

[0022] The first IPsec SA is configured by the user via command line.

[0023] Thirdly, this application provides a network device including a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, which in turn cause the processor to perform the method provided in the first aspect of this application.

[0024] Therefore, using the communication method and apparatus provided in this application, after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, the first CPE sends a first keep-alive message to the second CPE through the data channel; the first CPE determines whether it receives the first keep-alive response sent by the second CPE through the data channel; if the first keep-alive response is received, the first CPE increments the anti-replay sequence number included in the data packet to be sent to the second CPE; wherein, the first IPsec SA is configured by the user through the command line.

[0025] Thus, after the local CPE manually configures and establishes an IPsec SA and stores the peer CPE's IPsec SA, it can determine whether the remote CPE has also configured, established, and stored the peer CPE's IPsec SA by sending a keep-alive message. When sending data packets to the remote CPE, the anti-replay sequence number included in the data packet is incremented. This solves the problem in existing SA generation methods where manually configured IPsec SAs cannot support anti-replay functionality, leading to packet loss. It enables manually configured and established IPsec SAs to also support anti-replay functionality. Attached Figure Description

[0026] Figure 1 A schematic diagram of an existing SDWAN network topology;

[0027] Figure 2 A flowchart illustrating the communication method provided in the embodiments of this application;

[0028] Figure 3 A structural diagram of a communication device provided in an embodiment of this application;

[0029] Figure 4 The network device hardware structure provided in the embodiments of this application. Detailed Implementation

[0030] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0031] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0032] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0033] The following is a detailed description of a communication method provided by an embodiment of this application. See also... Figure 2 , Figure 2 A flowchart illustrating a communication method provided in an embodiment of this application. This method is applied to a first CPE. The communication method provided in an embodiment of this application may include the following steps.

[0034] Step 210: After the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, send the first keep-alive message to the second CPE through the data channel;

[0035] Specifically, the first CPE is located within the SDWAN network, which also includes a second CPE. A data channel has been established between the first and second CPEs. This data channel is specifically an SDWAN tunnel or an IPsec tunnel.

[0036] Understandably, according to existing protocols, each CPE first establishes a control channel with the RR. After establishing the control channel, the RR sends TTE information to each CPE, enabling the CPEs to establish a data channel using the TTE information. This control channel specifically consists of an SSL connection and an SDWAN tunnel.

[0037] The control channels established between each CPE and RR, and the data channels established between each CPE, are the same as the process of establishing control channels and data channels in the existing SDWAN, and will not be repeated here.

[0038] The user (also known as the administrator) inputs configuration commands to the first CPE via command line. These commands include information for configuring the first IPsec SA. Based on the configuration commands, the first CPE establishes the first IPsec SA locally.

[0039] The process of establishing the first IPsec SA by the aforementioned first CPE is the same as the existing manual method of configuring and establishing an IPsec SA, and will not be repeated here.

[0040] It should be noted that each CPE sends its own IPsec SA to the RR through the control channel, and the RR then sends the IPsec SA to the peer CPE through the control channel again, so that each CPE can receive and store the peer CPE's IPsec SA and establish a correspondence between the local IPsec SA and the peer's IPsec SA.

[0041] After the first CPE has locally stored the first IPsec SA and the second IPsec SA of the second CPE, it generates a first keep-alive message. The first CPE sends the first keep-alive message to the second CPE through the data channel.

[0042] Optionally, after receiving the first keep-alive message through the data channel, the second CPE determines whether it has stored the second IPsec SA and the first IPsec SA locally.

[0043] If the second IPsec SA and the first IPsec SA are already stored locally, the second CPE generates a first keep-alive response and sends the first keep-alive response to the first CPE through the data channel.

[0044] If neither the first IPsec SA nor the second IPsec SA is stored locally, the second CPE will neither generate nor send a first keep-alive response to the first CPE, and will continue to wait locally to receive either the first IPsec SA or the second IPsec SA.

[0045] After storing both the second IPsec SA and the first IPsec SA locally, the second CPE sends the first keep-alive response to the first CPE through the data channel.

[0046] In this embodiment, the user still inputs configuration commands to the second CPE via command line. These configuration commands include information for configuring the second IPsec SA. Based on the configuration commands, the second CPE establishes the second IPsec SA locally.

[0047] It is understandable that when users manually configure IPsec SAs for each CPE, there is a certain time lag. This could result in the first CPE establishing the first IPsec SA, but the second CPE not receiving the first IPsec SA synchronized by RR, causing the second CPE to not simultaneously store both the first and second IPsec SAs locally. Alternatively, the second CPE might receive the first IPsec SA, but not receive or configure the second IPsec SA locally, again causing the second CPE to not simultaneously store both the first and second IPsec SAs locally. In such cases, the first CPE can probe whether the second CPE has simultaneously stored both the first and second IPsec SAs by sending a keep-alive message.

[0048] Step 220: Determine whether the first keep-alive response sent by the second CPE through the data channel has been received;

[0049] Specifically, according to the description of step 210, after the first CPE sends the first keep-alive message to the second CPE, it determines whether it has received the first keep-alive response sent by the second CPE through the data channel.

[0050] If the first CPE receives the first keep-alive response, the first CPE executes step 230.

[0051] Optionally, if the first CPE does not receive the first keep-alive response, the first CPE will keep the anti-replay sequence number included in the data packet to be sent to the second CPE unchanged.

[0052] It should be noted that before the first CPE receives the first keepalive response from the second CPE, the first CPE determines that the second CPE does not simultaneously store the first IPsec SA and the second IPsec SA. At this time, the second CPE cannot process the data packets sent by the first CPE. When generating the data packet to be sent, the first CPE keeps the anti-replay sequence number included in the data packet unchanged; for example, it fills the anti-replay sequence number with 0s.

[0053] If the first CPE does not receive the first keep-alive response from the second CPE, the anti-replay sequence number in the data to be sent generated by the first CPE remains unchanged, and the first keep-alive request continues to be sent to the second CPE within the set sending period.

[0054] Step 230: If the first keep-alive response is received, the anti-replay sequence number included in the data packet to be sent to the second CPE is incremented.

[0055] Specifically, according to the determination in step 220, if the first CPE receives the first keep-alive response, the first CPE increments the anti-replay sequence number included in the data packet to be sent to the second CPE. For example, for each data packet generated, the anti-replay sequence number included in the data packet is incremented by 1.

[0056] Therefore, using the communication method provided in this application, after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, the first CPE sends a first keep-alive message to the second CPE through the data channel; the first CPE determines whether it receives the first keep-alive response sent by the second CPE through the data channel; if the first keep-alive response is received, the first CPE increments the anti-replay sequence number included in the data packet to be sent to the second CPE; wherein, the first IPsec SA is configured by the user through the command line.

[0057] Thus, after the local CPE manually configures and establishes an IPsec SA and stores the peer CPE's IPsec SA, it can determine whether the remote CPE has also configured, established, and stored the peer CPE's IPsec SA by sending a keep-alive message. When sending data packets to the remote CPE, the anti-replay sequence number included in the data packet is incremented. This solves the problem in existing SA generation methods where manually configured IPsec SAs cannot support anti-replay functionality, leading to packet loss. It enables manually configured and established IPsec SAs to also support anti-replay functionality.

[0058] Optionally, in this embodiment, the method further includes a process whereby the second CPE sends a second keep-alive message to the first CPE after storing the second IPsec SA and the first IPsec SA locally. Through this process, the second CPE detects whether the first CPE has stored the first IPsec SA and the second IPsec SA.

[0059] Specifically, the user inputs configuration commands to the second CPE via command line. These commands include information for configuring the second IPsec SA. Based on the configuration commands, the second CPE establishes the second IPsec SA locally.

[0060] The second CPE also receives the first IPsec SA synchronized by RR. The second CPE stores the first IPsec SA and establishes a mapping between the first IPsec SA and the second IPsec SA.

[0061] After the second CPE has locally stored the second IPsec SA and the first IPsec SA, it generates a second keep-alive message. The second CPE then sends the second keep-alive message to the first CPE via the data channel.

[0062] After receiving the second keep-alive message through the data channel, the first CPE determines whether the first IPsec SA and the second IPsec SA have been stored locally.

[0063] If the first IPsec SA and the second IPsec SA are already stored locally, the first CPE generates a second keep-alive response and sends the second keep-alive response to the second CPE through the data channel.

[0064] Optionally, if neither the first IPsec SA nor the second IPsec SA is stored locally, the first CPE will neither generate nor send a second keep-alive response to the second CPE, and will continue to wait locally to receive either the first IPsec SA or the second IPsec SA.

[0065] After storing the first IPsec SA and the second IPsec SA locally, the first CPE sends a second keep-alive response to the second CPE through the data channel.

[0066] Please see Figure 1 The network shown is in Figure 1 In this configuration, CPE1 and CPE2 establish control channels with RR. RR uses these control channels to send TTE information from the peer CPE to each CPE. Each CPE then uses the TTE information to establish a data channel with the peer. In this embodiment, a data channel has already been established between CPE1 and CPE2.

[0067] First, the user enters configuration commands into CPE1 via the command line. These commands include information for configuring IPsec SA1. Based on the configuration commands, CPE1 establishes IPsec SA1 locally.

[0068] Then, the user enters configuration commands into the CPE2 via the command line. These commands include information for configuring IPsec SA2. Based on the configuration commands, the CPE2 establishes IPsec SA2 locally.

[0069] After CPE1 establishes IPsec SA1, it sends IPsec SA1 to RR through the control channel. Upon receiving it, RR synchronizes with CPE2 through the control channel. After receiving IPsec SA1, CPE2 stores IPsec SA1 locally. If CPE2 establishes IPsec SA2 locally, then CPE2 establishes the mapping relationship between IPsec SA1 and IPsec SA2.

[0070] Similarly, after CPE2 establishes IPsec SA2, it sends IPsec SA2 to RR through the control channel. After receiving it, RR synchronizes with CPE1 through the control channel. After receiving IPsec SA2, CPE1 stores IPsec SA2 locally. If CPE1 establishes IPsec SA1 locally, then CPE1 establishes the mapping relationship between IPsec SA1 and IPsec SA2.

[0071] After CPE1 locally stores IPsec SA1 and IPsec SA2, it generates the first keep-alive message. CPE1 then sends the first keep-alive message to CPE2 via the data channel.

[0072] After receiving the first keep-alive message through the data channel, CPE2 determines whether IPsec SA1 and IPsec SA2 have been stored locally.

[0073] If IPsec SA1 and IPsec SA2 are already stored locally, CPE2 generates the first keep-alive response and sends it to CPE1 via the data channel.

[0074] If neither IPsec SA1 nor IPsec SA2 is stored locally, CPE2 will neither generate nor send a first keepalive response to CPE1, and will continue to wait locally to receive either IPsec SA1 or IPsec SA2. After storing both IPsec SA1 and IPsec SA2 locally, CPE2 will then send a first keepalive response to CPE1 through the data channel.

[0075] After CPE1 sends the first keep-alive message to RR, it determines whether it has received the first keep-alive response sent by CPE2 through the data channel.

[0076] If CPE1 receives the first keepalive response, CPE1 increments the anti-replay sequence number included in the data packet to be sent to CPE2. For example, for each data packet generated, the anti-replay sequence number included in the data packet is incremented by 1.

[0077] If CPE1 does not receive the first keepalive response, it determines that CPE2 does not store IPsec SA1 and IPsec SA2, and CPE2 cannot process the data packets sent by CPE1. When generating the data packet to be sent, CPE1 keeps the anti-replay sequence number in the data packet unchanged; for example, it fills the anti-replay sequence number with 0. CPE1 continues to send the first keepalive request to CPE2 within the set transmission period.

[0078] Similarly, after CPE2 has stored IPsec SA1 and IPsec SA2 locally, it generates a second keepalive message. CPE2 then sends the second keepalive message to CPE1 via the data channel.

[0079] After receiving the second keepalive message through the data channel, CPE1 determines whether IPsec SA1 and IPsec SA2 have been stored locally.

[0080] If IPsec SA1 and IPsec SA2 are already stored locally, CPE1 generates a second keep-alive response and sends it to CPE2 via the data channel.

[0081] If neither IPsec SA1 nor any of the IPsec SAs are stored locally, CPE1 will neither generate nor send a second keepalive response to CPE2, and will continue to wait locally to receive either IPsec SA1 or IPsec SA2. After storing both IPsec SA1 and IPsec SA2 locally, CPE1 will then send a second keepalive response to CPE2 through the data channel.

[0082] Based on the same inventive concept, embodiments of this application also provide a communication device corresponding to the communication method. See also Figure 3 , Figure 3 The communication device provided in this application embodiment is applied to a first CPE, the first CPE is located in an SDWAN network, the SDWAN network also includes a second CPE, a data channel has been established between the first CPE and the second CPE, and the device includes: a sending unit 310, a first judging unit 320, a processing unit 330 and a receiving unit 340.

[0083] The sending unit 310 is used to send the first keep-alive message to the second CPE through the data channel after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally.

[0084] The first determining unit 320 is used to determine whether the receiving unit 340 has received the first keep-alive response sent by the second CPE through the data channel;

[0085] The processing unit 330 is configured to increment the anti-replay sequence number included in the data packet to be sent to the second CPE if the receiving unit 340 receives the first keep-alive response;

[0086] The first IPsec SA is configured by the user via command line.

[0087] Optionally, the device further includes a holding unit (not shown in the figure) for keeping the anti-replay sequence number included in the data packet to be sent to the second CPE unchanged if the first keep-alive response is not received.

[0088] Optionally, the first keep-alive response is sent through the data channel after the second CPE receives the first keep-alive message and has stored the second IPsec SA and the first IPsec SA locally;

[0089] The second IPsec SA is configured by the user via command line.

[0090] Optionally, the receiving unit 340 is further configured to receive a second keep-alive message sent by the second CPE through the data channel;

[0091] The device further includes: a second determination unit (not shown in the figure), used to determine whether the first IPsec SA and the second IPsec SA have been stored locally;

[0092] The sending unit 310 is further configured to send the second keep-alive response to the second CPE through the data channel if the first IPsec SA and the second IPsec SA have been stored locally.

[0093] Optionally, the sending unit 310 is further configured to send a second keep-alive response to the second CPE without the data channel if neither the first IPsec SA nor the second IPsec SA is stored locally.

[0094] After storing the first IPsec SA and the IPsec SA locally, the second keep-alive response is sent to the second CPE through the data channel.

[0095] Therefore, using the communication device provided in this application, after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, the first CPE sends a first keep-alive message to the second CPE through the data channel; the first CPE determines whether it receives the first keep-alive response sent by the second CPE through the data channel; if the first keep-alive response is received, the first CPE increments the anti-replay sequence number included in the data packet to be sent to the second CPE; wherein, the first IPsec SA is configured by the user through the command line.

[0096] Thus, after the local CPE manually configures and establishes an IPsec SA and stores the peer CPE's IPsec SA, it can determine whether the remote CPE has also configured, established, and stored the peer CPE's IPsec SA by sending a keep-alive message. When sending data packets to the remote CPE, the anti-replay sequence number included in the data packet is incremented. This solves the problem in existing SA generation methods where manually configured IPsec SAs cannot support anti-replay functionality, leading to packet loss. It enables manually configured and established IPsec SAs to also support anti-replay functionality.

[0097] Based on the same inventive concept, embodiments of this application also provide a network device, such as... Figure 4 As shown, the system includes a processor 410, a transceiver 420, and a machine-readable storage medium 430. The machine-readable storage medium 430 stores machine-executable instructions that can be executed by the processor 410. The processor 410 is prompted by the machine-executable instructions to execute the communication method provided in the embodiments of this application. (The foregoing...) Figure 3 The communication device shown can be used as follows: Figure 4 The hardware structure of the network device shown is implemented.

[0098] The aforementioned computer-readable storage medium 430 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium 430 may also be at least one storage device located remotely from the aforementioned processor 410.

[0099] The processor 410 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0100] In this embodiment of the application, the processor 410 reads the machine-executable instructions stored in the machine-readable storage medium 430, and is prompted by the machine-executable instructions to enable the processor 410 itself and the transceiver 420 to execute the communication method described in the foregoing embodiment of the application.

[0101] In addition, this application provides a machine-readable storage medium 430 that stores machine-executable instructions. When called and executed by the processor 410, the machine-executable instructions cause the processor 410 itself and the transceiver 420 to execute the communication method described in the aforementioned application.

[0102] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0103] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0104] For the embodiments of communication devices and machine-readable storage media, since the methods involved are basically similar to those of the aforementioned method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0105] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A communication method, characterized in that, The method is applied to a first CPE, which is located within an SDWAN network. The SDWAN network also includes a second CPE, and a data channel has been established between the first CPE and the second CPE. The method includes: Once the first IPsec SA and the second IPsec SA of the second CPE have been stored locally, a first keep-alive message is sent to the second CPE through the data channel. Determine whether a first keep-alive response sent by the second CPE through the data channel has been received; If the first keep-alive response is received, the anti-replay sequence number included in the data packet to be sent to the second CPE will be incremented. The method further includes: If the first keep-alive response is not received, the anti-replay sequence number included in the data packet to be sent to the second CPE remains unchanged; The first IPsec SA is configured by the user via command line.

2. The method according to claim 1, characterized in that, The first keep-alive response is sent through the data channel after the second CPE receives the first keep-alive message and has stored the second IPsec SA and the first IPsec SA locally; The second IPsec SA is configured by the user via command line.

3. The method according to claim 1, characterized in that, The method further includes: The second keep-alive message sent by the second CPE is received through the data channel; Determine whether the first IPsec SA and the second IPsec SA have been stored locally; If the first IPsec SA and the second IPsec SA are already stored locally, a second keep-alive response is sent to the second CPE through the data channel.

4. The method according to claim 3, characterized in that, The method further includes: If neither the first IPsec SA nor the second IPsec SA is stored locally, the second keep-alive response is not sent to the second CPE through the data channel; After storing the first IPsec SA and the second IPsec SA locally, the second keep-alive response is sent to the second CPE through the data channel.

5. A communication device, characterized in that, The device is applied to a first CPE, which is located within an SDWAN network. The SDWAN network also includes a second CPE. A data channel has been established between the first CPE and the second CPE. The device includes: a sending unit, a first judgment unit, a processing unit, and a receiving unit. The sending unit is used to send a first keep-alive message to the second CPE through the data channel after the first IPsec SA and the second IPsec SA of the second CPE have been stored locally. The first determining unit is used to determine whether the receiving unit has received the first keep-alive response sent by the second CPE through the data channel; The processing unit is configured to increment the anti-replay sequence number included in the data packet to be sent to the second CPE if the receiving unit receives the first keep-alive response; The device further includes: The holding unit is configured to keep the anti-replay sequence number included in the data packet to be sent to the second CPE unchanged if the first keep-alive response is not received; The first IPsec SA is configured by the user via command line.

6. The apparatus according to claim 5, characterized in that, The first keep-alive response is sent through the data channel after the second CPE receives the first keep-alive message and has stored the second IPsec SA and the first IPsec SA locally; The second IPsec SA is configured by the user via command line.

7. The apparatus according to claim 5, characterized in that, The receiving unit is further configured to receive a second keep-alive message sent by the second CPE through the data channel; The device further includes: a second determination unit, configured to determine whether the first IPsec SA and the second IPsec SA have been stored locally; The sending unit is further configured to send a second keep-alive response to the second CPE through the data channel if the first IPsec SA and the second IPsec SA are already stored locally.

8. The apparatus according to claim 7, characterized in that, The sending unit is further configured to, if neither the first IPsec SA nor the second IPsec SA is stored locally, send a second keep-alive response to the second CPE without using the data channel; After storing the first IPsec SA and the second IPsec SA locally, the second keep-alive response is sent to the second CPE through the data channel.

Images